[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 01/10] block/vhdx: fix dynamic VHDX BAT corruption
From: |
Kevin Wolf |
Subject: |
[PULL 01/10] block/vhdx: fix dynamic VHDX BAT corruption |
Date: |
Tue, 11 Apr 2023 17:01:38 +0200 |
From: Lukas Tschoke <lukts330@gmail.com>
The corruption occurs when a BAT entry aligned to 4096 bytes is changed.
Specifically, the corruption occurs during the creation of the LOG Data
Descriptor. The incorrect behavior involves copying 4088 bytes from the
original 4096 bytes aligned offset to `tmp[8..4096]` and then copying
the new value for the first BAT entry to the beginning `tmp[0..8]`.
This results in all existing BAT entries inside the 4K region being
incorrectly moved by 8 bytes and the last entry being lost.
This bug did not cause noticeable corruption when only sequentially
writing once to an empty dynamic VHDX (e.g.
using `qemu-img convert -O vhdx -o subformat=dynamic ...`), but it
still resulted in invalid values for the (unused) Sector Bitmap BAT
entries.
Importantly, this corruption would only become noticeable after the
corrupted BAT is re-read from the file.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/727
Cc: qemu-stable@nongnu.org
Signed-off-by: Lukas Tschoke <lukts330@gmail.com>
Message-Id: <6cfb6d6b-adc5-7772-c8a5-6bae9a0ad668@gmail.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
block/vhdx-log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/vhdx-log.c b/block/vhdx-log.c
index c48cf65d62..38148f107a 100644
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -981,7 +981,7 @@ static int vhdx_log_write(BlockDriverState *bs,
BDRVVHDXState *s,
sector_write = merged_sector;
} else if (i == sectors - 1 && trailing_length) {
/* partial sector at the end of the buffer */
- ret = bdrv_pread(bs->file, file_offset,
+ ret = bdrv_pread(bs->file, file_offset + trailing_length,
VHDX_LOG_SECTOR_SIZE - trailing_length,
merged_sector + trailing_length, 0);
if (ret < 0) {
--
2.39.2
- [PULL 00/10] Block layer fixes for 8.0-rc4, Kevin Wolf, 2023/04/11
- [PULL 07/10] migration/block: replace uses of blk_nb_sectors that do not check result, Kevin Wolf, 2023/04/11
- [PULL 03/10] block: move has_variable_length to BlockLimits, Kevin Wolf, 2023/04/11
- [PULL 05/10] block: refresh bs->total_sectors on reopen, Kevin Wolf, 2023/04/11
- [PULL 08/10] block-backend: inline bdrv_co_get_geometry, Kevin Wolf, 2023/04/11
- [PULL 06/10] block: remove has_variable_length from BlockDriver, Kevin Wolf, 2023/04/11
- [PULL 10/10] block, block-backend: write some hot coroutine wrappers by hand, Kevin Wolf, 2023/04/11
- [PULL 09/10] block-backend: ignore inserted state in blk_co_nb_sectors, Kevin Wolf, 2023/04/11
- [PULL 02/10] iotests: Regression test for vhdx log corruption, Kevin Wolf, 2023/04/11
- [PULL 01/10] block/vhdx: fix dynamic VHDX BAT corruption,
Kevin Wolf <=
- [PULL 04/10] block: remove has_variable_length from filters, Kevin Wolf, 2023/04/11
- Re: [PULL 00/10] Block layer fixes for 8.0-rc4, Peter Maydell, 2023/04/12